System and method of searching for classifying user activity performed on a computer system

ABSTRACT

The invention is directed to a system and method of managing information associated with user actions. A monitoring system may gather and store information associated with user actions. Relationships may be inferred between user actions based on time or other criteria. A user may define classifications of user actions. These classifications may be used to retrieve information associated with user actions.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.11/471,631, entitled “System and Method of Searching for ClassifyingUser Activity Performed on a Computer System,” filed Jun. 21, 2006,which issued as U.S. Pat. No. 7,707,284 on Apr. 27, 2010, and whichclaims the benefit of U.S. Provisional Patent Application Serial No.60/706,009, entitled “System and Method of Analyzing a Timeline andPerforming. Search Functions,” filed Aug. 8, 2005, and which is furthera continuation-in-part of U.S. patent application Ser. No. 11/195,754,entitled “System and Method of Implementing User Action Monitoring toAutomatically Populate Object Launchers,” filed Aug. 3, 2005, whichissued as U.S. Pat. No. 7,184,939 on Feb. 27, 2007, U.S. patentapplication Ser. No. 11/195,731, entitled “System and Method ofSearching for Information Based on Prior User Actions,” filed Aug. 3,2005, which issued as U.S. Pat. No. 7,502,798 on Mar. 10, 2009, and U.S.patent application Ser. No. 11/229,628, entitled “System and Method ofAssociating Objects in Search Results,” filed Sep. 20, 2005, whichissued as U.S. Pat. No. 7,440,948 on Oct. 21, 2008, each of which arehereby incorporated by reference in their entirety.

BACKGROUND

1. Field of the Invention

This invention relates to a system and method of monitoring andclassifying information corresponding to actions initiated by a user ona computer.

2. Background Information

During the course of a computer session, many actions may be performedon a computer. For several reasons, including increasing workforceproductivity, it may be desirable to monitor these actions. Knownapplications enable monitoring of actions performed on the computerthrough logging of events, such as keystrokes, web sites visited, emailssent/received, windows viewed, and passwords entered. Known applicationsfurther enable capturing of screen shots at scheduled time intervals.Known event monitoring applications are typically run in stealth mode tomake them undetectable to users of the monitored computer.

Other known applications enable monitoring of actions performed on thecomputer through direct monitoring of select types of object-levelactions performed using a single application or through directmonitoring of select types of object-level actions performed in a suiteof associated applications. Once the select types of object-levelactions are logged, they may be displayed.

While known applications present logged events and/or selected types ofobject-level actions, known applications are deficient at least becausethey do not monitor and log all types of object-level actions performedacross multiple unrelated applications. Additionally, known applicationsare deficient because they do not identify relationships between theevents and/or selected types of object-level actions. For example, knownapplications do not analyze information associated with each eventand/or selected type of object-level action to infer relationshipsbetween two or more events and/or two or more objects. Furthermore,known applications are deficient because they do not enable searchingfor events and/or objects based on the observed actions.

Other drawbacks exist with these and other known applications.

SUMMARY

Various aspects of the invention overcome at least some of these andother drawbacks of known applications. According to one embodiment ofthe invention, a system is provided that includes at least one clientterminal having a processor, a memory, a display and at least one inputmechanism (e.g., keyboard or other input mechanism). The client terminalmay be connected or connectable to other client terminals via wired,wireless, and/or a combination of wired and wireless connections and/orto servers via wired, wireless, and/or a combination of wired andwireless connections.

Each client terminal preferably includes, or may be modified to include,monitoring software described herein that operates in the background toobserve all types of actions performed on the corresponding clientterminal. The actions may be associated with objects, includingapplications, documents, files, email messages, chat sessions, websites, address book entries, calendar entries or other objects. Objectsmay include information such as personal information, user data andother information. Other applications may reside on the client terminalas desired.

The actions performed during the computer session may be initiated byusers and/or computers. Regarding user initiated actions, users maydirectly or indirectly access several types of objects during the courseof the computer session. According to one embodiment of the invention,users may perform actions through a graphical user interface (GUI) orother interface. According to one embodiment of the invention, userinitiated actions may be tracked using triggering events. According toanother embodiment of the invention, user initiated actions may betracked at any level including, for example, the window level and/orother levels. The type of information that corresponds to user initiatedactions may include, for example, when objects are opened and closed,when users switch focus between different objects and/or windows, idletimes, when users type on a keyboard, when users manipulate a mouse, andother user initiated action information.

Regarding computer initiated actions, computers may directly orindirectly access several types of objects during the course of thecomputer session. According to one embodiment of the invention,computers may perform actions including generating a reminder,activating a screen saver, initiating an auto save, automaticallydownloading information from a web site (such as an update file), andperforming other computer initiated actions. According to anotherembodiment of the invention, computer initiated actions may be trackedusing triggering events. The type of information that corresponds tocomputer initiated actions may include, for example, when objects areautomatically opened and/or closed, when the screen saver is activated,when an auto save is activated, and other computer initiated actioninformation.

The information corresponding to user initiated actions and computerinitiated actions may be displayed according to various configurations.For example, information corresponding to user initiated actions andcomputer initiated actions may be organized and displayed in a timeline.In one embodiment of the invention, user initiated action informationand computer initiated action information may be combined and displayedintegrally in a timeline according to user defined configurations. Inanother embodiment of the invention, user initiated action informationand computer initiated action information may be displayed separatelyaccording to user defined configurations. According to one embodiment ofthe invention, information corresponding to the user initiated actionsand/or the computer initiated actions may be presented as graphicalinformation through screenshots, charts, and/or other graphicalinformation. According to another embodiment of the invention,information corresponding to the user initiated actions and/or thecomputer initiated actions may be displayed in a linear format,non-linear format or other format.

According to one embodiment of the invention, a correlation determiningsystem is provided that analyzes information associated with the userinitiated actions that relate to these objects. Relationships may beinferred between objects based on a chronological proximity of userinitiated actions, a chronological proximity of window focus toggling,or other information. Once relationships are discovered between two ormore objects, the strength of the relationships may be determined usinga relevance ranking that is based on a variety of factors associatedwith the user initiated actions and the computer initiated actions. Arelationship between objects may be identified if the strength of therelationship is determined to exceed a predefined threshold value. Inaddition, a relationship may be displayed in a timeline along with userinitiated actions and computer initiated actions.

According to an embodiment of the invention, a user-definedclassification system is provided that allows users to define categoriesof information associated with user initiated actions. Theclassification system classifies information associated with userinitiated actions according to the categories defined by the user. Theinformation may be retrieved and displayed according to the categories.

These and other objects, features, and advantages of the invention willbe apparent through the detailed description of the embodiments and thedrawings attached hereto. It is also to be understood that both theforegoing general description and the following detailed description areexemplary and not restrictive of the scope of the invention. Numerousother objects, features, and advantages of the invention should nowbecome apparent upon a reading of the following detailed descriptionwhen taken in conjunction with the accompanying drawings, a briefdescription of which is included below. Where applicable, same featureswill be identified with the same reference numbers throughout thevarious drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates an exemplary embodiment of a system diagram accordingto an embodiment of the invention.

FIG. 2 illustrates an exemplary embodiment of a timeline according to anembodiment of the invention.

FIG. 3 illustrates a flow chart schematic for analyzing relationshipsbetween objects according to an embodiment of the invention.

FIG. 4 illustrates an exemplary embodiment of a user-definedclassification system according to an embodiment of the invention.

FIG. 5 illustrates a flow chart schematic for organizing and managinguser action information according to an embodiment of the invention.

DETAILED DESCRIPTION

FIG. 1 illustrates an example of the system architecture 100 accordingto one embodiment of the invention. Client terminals 112 a-112 n(hereinafter identified collectively as 112) and server(s) 130 may beconnected via a wired network, a wireless network, a combination of theforegoing and/or other network(s) (for example the Internet) 120. Thesystem of FIG. 1 is provided for illustrative purposes only and shouldnot be considered a limitation of the invention. Other configurationsmay be used.

The client terminals 112 may include any number of terminal devicesincluding, for example, personal computers, laptops, PDAs, cell phones,Web TV systems, devices that combine the functionality of one or more ofthe foregoing or other terminal devices, and various other clientterminal devices capable of performing the functions specified herein.According to one embodiment of the invention, users may be assigned toone or more client terminals.

According to one embodiment of the invention, communications may bedirected between one client terminal 112 and another client terminal 112via network 120, such as the Internet. Client terminals 112 maycommunicate via communications media 115 a-115 n (hereinafter identifiedcollectively as 115), such as, for example, any wired and/or wirelessmedia. Communications between respective client terminals 112 may occursubstantially in real-time if the client terminals 112 are operatingonline.

According to another embodiment of the invention, communications may bedirected between client terminals 112 and content server(s) 150 vianetwork 120, such as the Internet. Client terminals 112 may communicatevia communications media 115, such as, for example, any wired and/orwireless media. Communications between client terminals 112 and thecontent server 150 may occur substantially in real-time if the devicesare operating online. One of ordinary skill in the art will appreciatethat communications may be conducted in various ways and among otherdevices.

Communications via network 120, such as the Internet, may be implementedusing current and future language conventions and/or current and futurecommunications protocols that are generally accepted and used forgenerating and/or transmitting messages over the network 120. Languageconventions may include Hypertext Markup Language (“HTML”), eXtensibleMarkup Language (“XML”) and other language conventions. Communicationsprotocols may include, Hypertext Transfer Protocol (“HTTP”), TCP/IP,SSL/TLS, FTP, GOPHER, and/or other protocols.

According to one embodiment of the invention, client terminals 112 mayinclude, or be modified to include, corresponding monitoring software113 a-113 n (hereinafter identified collectively as 113) that mayoperate in the background to observe all types of actions performed onthe corresponding client terminal 112. The types of actions performed onthe corresponding client terminal 112 may be monitored for anyapplications accessed through the client terminal. The actions may beassociated with objects, including applications, documents, files, emailmessages, chat sessions, web sites, address book entries, calendarentries or other objects. The objects may include information such aspersonal information, user data, or other information. According to oneembodiment of the invention, monitoring software 113 may includeclient-side monitoring software. According to another embodiment of theinvention, monitoring software 113 may include server-side monitoringsoftware, such as monitoring system 132 that resides on server 130.Agents may be placed on the client terminal 112 to communicateinformation between monitoring system 132 and the client terminal 112.One of ordinary skill in the art will appreciate that otherconfigurations may be available for deploying the monitoring software113.

The actions performed during the computer session may be initiated byusers and/or computers. Regarding user initiated actions, users maydirectly or indirectly access several types of objects during the courseof the computer session. According to one embodiment of the invention,users may perform actions through a graphical user interface (GUI) orother interface. According to one embodiment of the invention, userinitiated actions may be tracked using triggering events, includingapplication level activity, user actions performed on objects, a user'sactivity focus, and/or other triggering events. According to anotherembodiment of the invention, user initiated actions may be tracked atany level including, for example, the window level and/or other levels.The type of information that corresponds to user initiated actions mayinclude, for example, when objects are opened and closed, when usersswitch focus between different objects and/or windows, idle times, whenusers type on a keyboard, when users manipulate a mouse, and/or otheruser initiated action information.

Regarding computer initiated actions, computers may directly orindirectly access several types of objects during the course of thecomputer session. According to one embodiment of the invention,computers may perform actions including generating a reminder,activating a screen saver, initiating an auto save, automaticallydownloading information from a web site (such as an update file), andperforming other computer initiated actions. According to one embodimentof the invention, computer initiated actions may be tracked usingtriggering events including, for example, launching of a screen saver,initiating an auto save, and/or other triggering events. The type ofinformation that corresponds to computer initiated actions may include,for example, when objects are automatically opened and/or closed, whenthe screen saver is activated, when an auto save is activated, and othercomputer initiated action information.

According to one embodiment of the invention, the monitoring software113 may operate undetected by the user. For example, the monitoringsoftware 113 may be transparent to the user and may not appear in thewindows task manager, in the registry, startup utilities, and/or othervisible locations. In another embodiment of the invention, themonitoring software 113 may operate undetected by the user, but theresults may be viewed on demand by users. In yet another embodiment ofthe invention, the monitoring software 113 may operate with userawareness. One of ordinary skill in the art will readily appreciate thatother implementations may be used to monitor and/or view resultsassociated with the observed actions.

According to another embodiment of the invention, the monitoringsoftware 113 may gather information associated with the observed userinitiated actions and/or computer initiated actions according to severaltechniques. In one embodiment of the invention, the information may begathered using direct observation. For example, the information may begathered by directly observing a window-based system for trackinginformation including, for example, tracking when windows appear and/ordisappear from the graphical user interface, tracking which window onthe GUI is focused, and other tracking information. In anotherembodiment of the invention, the information may be gathered by directlyobserving the windows-based system and mapping windows back to theassociated applications, among other mapping information. In yet anotherembodiment of the invention, the information may be gathered by directlyobserving the windows-based system to monitor when the client terminalis actively being used or sitting idle, among other status information.

In an alternative embodiment of the invention, the monitoring software,113 may operate in a mode that gathers information associated with theobserved user initiated actions and/or computer initiated actions byconfiguring other applications to broadcast action information.According to one exemplary embodiment of the invention, the monitoringsoftware 113 may configure a browser application or other application togenerate and send messages, such as a time-stamped message or otheridentifying messages, that inform the monitoring software 113 of theaction being implemented by the browser such as, for example, “openinghttp://www.novell.com in window 12345,” among other actions. One ofordinary skill in the art will readily appreciate that other techniquesmay be used to gather information associated with the observed userinitiated actions and/or computer initiated actions.

According to one embodiment of the invention, user actions are monitoredat the application level and/or at the object level. Informationregarding the user actions may be stored, including informationregarding start/stop times that objects are accessed, a chronologicalorder that objects are accessed, and other events.

According to one embodiment of the invention, information correspondingto user initiated actions and computer initiated actions may beprocessed in real-time or may be stored for subsequent processing.Storage 140, or other storage device, may be used to store the userinitiated actions and computer initiated actions, among other data.

According to another embodiment of the invention, separate applicationsmay be used to monitor and organize the gathered information. Forexample, a first application may be used to gather information accordingto one or more of the direct observation monitoring technique, theapplication configuration monitoring technique and other monitoringtechniques. A second application may be used to organize the informationassociated with all of the observed types of actions including, forexample, collating and chronologically organizing records of theobserved actions, generating any user-defined listing of informationcorresponding to the observed actions, or applying any other organizingtechniques. The separate applications may be embodied in the monitoringsoftware 113, the monitoring system 132, or a combination thereof, amongother configurations. One of ordinary skill in the art will readilyappreciate that several configurations may be used to monitor and/ororganize information associated with all the observed types of actions.

According to another embodiment of the invention, a single applicationmay be used to monitor and organize the gathered information. Forexample, a single application may include both an observer componentthat gathers information corresponding to actions that are performed ona computer and an information organizing component, among othercomponents. For example, the single application may be configured toobserve and organize user initiated actions associated with objectsincluding, for example, opening/closing objects, switching betweenobjects/windows, and other user initiated actions. The singleapplication may also observe and organize computer initiated actionsincluding, for example, generating a reminder, creating new windows,activating a screen saver, initiating idle time, generating focus-levelinformation, generating application-level information (i.e., opening anapplication and closing it), and/or other computer initiated actions.The single application may be embodied in the monitoring software 113,the monitoring system 132, or a combination thereof, among otherconfigurations.

The information corresponding to user initiated actions and computerinitiated actions may be displayed according to various configurations.As illustrated in FIG. 2, information corresponding to user initiatedactions and computer initiated actions may be organized and displayed ina timeline 210. For example, timeline 210 may be arranged to includeobject entries that are organized in chronological time order. Display200 may include a display portion 220 that illustrates the content ofobject entries, wherein the content may include information such as,screenshots, dates that objects are accessed, times that objects areaccessed, lengths of time that objects are active, and/or otherinformation. Display 200 may also include a portion 230 that listsactive objects. In another embodiment of the invention, information maybe organized and displayed according to other configurations.

In one embodiment of the invention, user initiated action informationand computer initiated action information may be combined and displayedintegrally in a timeline according to user defined configurations. Inanother embodiment of the invention, user initiated action informationand computer initiated action information may be displayed separatelyaccording to user defined configurations. Regarding the separate displayof user initiated action information and computer initiated actioninformation, a first timeline may be provided that displays userinitiated actions according to a first user defined configuration. Asecond timeline may be provided that displays computer initiated actionsaccording to a second user defined configuration. According to anotherembodiment of the invention, information corresponding to the userinitiated actions and/or the computer initiated actions may be displayedin a non-linear format or other format. One of ordinary skill in the artwill appreciate that various configurations may be provided fororganizing and/or displaying the information corresponding to the userinitiated actions and the computer initiated actions.

According to one embodiment of the invention, information correspondingto the user initiated actions and/or the computer initiated actions maybe presented as graphical information through screenshots, charts,and/or other graphical information. Graphical information may beassociated with objects and may be displayed with corresponding objects.The graphical information may be captured using triggering eventsassociated with the user initiated actions and/or computer initiatedactions, including application level changes, active window title barschanges, window focus changes, and/or other triggering events. In oneexemplary embodiment of the invention, the graphical information mayinclude a screenshot that captures. GUI content as presented to theuser.

According to one embodiment of the invention, users may be assigned toseveral client terminals 112. Thus, one or more monitoring applications113 may be associated with users. According to another embodiment of theinvention, a roaming monitoring application may be assigned to usersthat enables one monitoring application to operate on several clientdevices. The timeline associated with a selected user may include anaggregate timeline that organizes and displays information provided fromone or more client terminals 112 that are associated with the selecteduser. Alternatively, several timelines may be associated with theselected user and may be separately displayed. One of ordinary skill inthe art will readily appreciate that other techniques may be used tomonitor and/or view results associated with one or more clientterminals.

According to another embodiment of the invention, informationcorresponding to user initiated actions and computer initiated actionsmay be analyzed by correlation determining system 134. FIG. 3illustrates a flow diagram 300 of a generalized method for determiningwhether relationships exist between objects. In operation 310, timelineinformation is analyzed. For example, timeline information may beanalyzed to discover that a first object (i.e., an email message) wasopened, followed by the opening of a second object (i.e., a wordprocessing application), followed by the opening and modification of athird object (i.e., a word processing document). According to anotherembodiment of the invention, correlation determining system 134 mayanalyze parameters derived from information associated with the userinitiated actions relating to these objects including, for example, atemporal order in which the objects are accessed, focus toggling betweenthe first object and the third object, opening the first objectcontemporaneously with the third object, or other user initiatedactions, to infer relationships between objects. One of ordinary skillin the art will readily appreciate that other techniques may be used toinfer relationships between objects.

In operation 315, relationships may be inferred between objects based ona chronological proximity of user initiated actions, a chronologicalproximity of window focus toggling, or other time-based information.Other types of information may be analyzed to infer relationshipsbetween objects. One of ordinary skill in the art will readilyappreciate that relationships between objects may be inferred byanalyzing one or more different parameters derived from commoninformation that corresponds to user initiated actions and/or computerinitiated actions.

According to an alternative embodiment of the invention, informationcorresponding to user initiated actions including, for example, atemporal proximity in which users access two or more objects, a temporalproximity in which users create two or more objects, a temporalproximity in which users edit two or more objects, operations that usersconduct in close time proximity, or other information corresponding touser initiated action information, may be used to infer relationshipsbetween two or more objects. According to yet another embodiment of theinvention, various known statistical methods may be used to inferrelationships between two or more objects.

In operation 320, a threshold value may be established. Oncerelationships are discovered between two or more objects, the strengthof the relationships may be determined in operation 325 using arelevance ranking that is based on a variety of factors associated withthe user initiated actions and the computer initiated actions. Accordingto one embodiment of the invention, the relevance may be provided with avalue based on factors including, for example, a frequency of the userinitiated actions, simultaneous/sequential occurrence of user initiatedaction, a duration of user initiated actions, overall chronologicalproximity of user initiated actions, and/or other factors.

In operation 330, the strength of the relationships derived from thefactors may be compared to the threshold value. In operation 335,relationships between objects may be identified if the strength of therelationship is determined to exceed a predefined threshold value. Therelationship information may be stored as an entry in the chronologicaltime. Alternatively, in step 340, relationships between objects may notbe identified if the strength of the relationship is determined to bebelow a predefined threshold value. One of ordinary skill in the artwill readily appreciate that other techniques may be used to determinethe strength of relationships between objects. According to anotherembodiment of the invention, correlation determining system 134 mayanalyze parameters derived from information associated with userinitiated actions and/or computer initiated actions to discoverrelationships between objects.

According to one embodiment of the invention, correlation determiningsystem 134 may analyze parameters derived from information associatedwith user initiated actions and/or computer initiated actions todiscover relationships between objects. Thus, according to oneembodiment of the invention, relationships may be discovered withoutconsidering content of the objects. In an alternative embodiment of theinvention, a combination of content-searching and an analysis ofparameters derived from information associated with user initiatedactions and/or computer initiated actions may be used to discoverrelationships between objects. By contrast, in the example discussedabove, known systems that only rely on content-based searching todiscover relationships between objects would not identify that the firstobject (i.e., an email message) is related to the third object (i.e., aword processing document), if the first object and the third objectinclude different content (e.g., terminology).

According to another embodiment of the current invention, a user-definedclassification system 136 may classify and retrieve informationassociated with user actions based upon categories defined by the user.

As shown in FIG. 4, a user-defined classification system 136 includes acategory definer 410 that enables a user to define categories forclassifying information associated with user action information. In apreferred embodiment, a user may access an interface 440, such as agraphical user interface (“GUI”), for establishing or definingcategories. The defined categories may include a work-related category,a hobby-related category, a travel-related category, a non-work-relatedcategory, and any other category desired by the user. In a preferredembodiment of the invention, category definer 410 allows a user tocreate nested categories. For example, a non-work-related category mayinclude a hobby-related category nested therein.

Once categories for user action information are defined, a user definedclassifier 420 communicates with monitoring software 113 and/ormonitoring software 132 to tag and store the information associated withuser actions (that is gathered and stored by the monitoring software)according to one or more defined categories. In one embodiment,information associated with user action may be stored in a single logalong with a defined classification for the information. In analternative embodiment, information associated with user action may bestored in separate logs based on a defined classification for theinformation.

A categorization analyzer 430 allows information associated with useractions to be managed based on defined categories. For example,categorization analyzer 430 may leverage monitoring software 113 and/ormonitoring software 132 to retrieve information related to one or moredefined categories. Further, categorization analyzer 430 allows searchesof user action information to be limited to search results that fallwithin a selected category. For example, a search conducted on awork-related category may produce search results from only thework-related category. In addition, categorization analyzer 430 mayallows user action information to be displayed graphically, such as on atimeline, according to the selected category.

An interface 440 may be provided to display an output fromcategorization analyzer 430 to the user. The interface may include avideo monitor or other device that is capable of displaying information.While separate components are illustrated in the embodiment shown inFIG. 4, one of ordinary skill in the art will readily appreciate thatone or more components may be configured to perform these functions andthat the functions may be performed using software or hardwarecomponents.

FIG. 5 depicts a process 500 for organizing and managing user actioninformation, according to embodiments of the invention. In operation502, a user may define one or more categories for monitoring informationassociated with user actions. The categories may include one or moreareas in which the user is interested in obtaining relevant informationregarding user action. For example, the defined categories may includeone or more work-related categories, a hobby-related category, atravel-related category, a personal-related category, and othercategories of interest. Categories may be nested within one another asdescribed above. A user may define the categories at any time prior tousing the categories.

After one or more categories are defined, information associated withuser actions that is gathered by the monitoring software may be taggedand stored according to one or more defined categories in operation 504.In a preferred embodiment, all information is tagged and storedaccording to one or more defined categories. Information may be storedin a single log along with information regarding a definedclassification. Alternatively, the information associated with useraction monitoring may be stored in separate logs based on a definedclassification.

In operation 506, information associated with user actions may bemanaged using the defined categories. Based on the classification ofuser action information into categories, a search on the user actioninformation may be limited to search results that fall within a selectedcategory. For example, a search conducted on the work-related categorywill not produce search results that are classified under a differentcategory, such as a hobby-related category. Further, informationassociated with user actions may be retrieved based on the definedcategories.

The foregoing presentation of the described embodiments is provided toenable any person skilled in the art to make or use the invention.Various modifications to these embodiments are possible, and the genericprinciples presented herein may be applied to other embodiments as well.For example, the invention may be implemented in part or in whole as ahard-wired circuit, as a circuit configuration fabricated into anapplication-specific integrated circuit, as a firmware program loadedinto non-volatile storage or a software program loaded from or into adata storage medium as machine-readable code, such code beinginstructions executable by an array of logic elements such as amicroprocessor or other digital signal processing unit, or may includeother implementations.

Embodiments of the invention include a computer program containing oneor more sequences of machine-readable instructions describing a methodas disclosed above, or a data storage medium (e.g. semiconductor memory,magnetic or optical disk) having such a computer program stored therein.The invention is not intended to be limited to the embodiments providedabove, but rather is to be accorded the widest scope consistent with theprinciples and novel features disclosed in any fashion herein. The scopeof the invention is to be determined solely by the appended claims.

1. A method for classifying activity performed on a computer system,comprising: monitoring the activity performed on the computer systemusing at least one electronic device coupled to the computer system,wherein the monitored activity includes a plurality of actions performedon the computer system and a plurality of objects accessed in theplurality of actions performed on the computer system; determining, bythe at least one electronic device, a chronological timeline for theplurality of actions performed on the computer system; inferring, by theat least one electronic device, one or more relationships between theplurality of objects and the plurality of actions in the chronologicaltimeline; classifying, by the at least one electronic device, each ofthe plurality of objects and each of the plurality of actions in one ormore of a plurality of categories based on the one or more inferredrelationships; and displaying the one or more inferred relationships ona display device.
 2. The method of claim 1, further comprising definingthe plurality of categories in response to the electronic devicereceiving an input that establishes the plurality of categories.
 3. Themethod of claim 2, wherein defining the plurality of categories includesnesting a first one of the plurality of categories within a second oneof the plurality of categories in response to the input that establishesthe plurality of categories.
 4. The method of claim 1, furthercomprising searching, by the at least one electronic device, theactivity performed on the computer system for one or more of theplurality of actions that are classified in one or more of the pluralityof categories.
 5. The method of claim 1, further comprising determining,by the at least one electronic device, a strength for each of the one ormore relationships, wherein the one or more relationships are inferredin response to determining that the strength for each of the one or morerelationships exceed a threshold value.
 6. The method of claim 5,wherein at least one of the relationships are not inferred in responseto determining that the strength for the at least one relationship doesnot exceed the threshold value.
 7. The method of claim 1, wherein theplurality of actions include one or more of actions that the computersystem performs or actions that a user performs on the computer system.8. The method of claim 1, wherein the chronological timeline for theplurality of actions comprises a first chronological timeline for afirst computer system, and wherein the method further comprises:monitoring, by the at least one electronic device, activity performed ona second computer system, wherein the monitored activity performed onthe second computer system includes one or more actions performed on thesecond computer system and one or more objects accessed in the one ormore actions performed on the second computer system; determining, bythe at least one electronic device, a second chronological timeline forthe one or more actions performed on the second computer system, wherein.the one or more actions performed on the second computer system eachoccur at a respective chronological position in the second chronologicaltimeline; and displaying an aggregate timeline for the first computersystem and the second computer system on the display device, wherein theaggregate timeline includes the plurality of actions performed on thefirst computer system and the one or more actions performed on thesecond computer system.
 9. The method of claim 1, wherein the pluralityof actions include each occur at a respective chronological position inthe chronological timeline.
 10. The method of claim 9, wherein the oneor more inferred relationships are derived from the chronologicalpositions for the plurality of actions in the chronological timeline.11. A system for classifying activity performed on a computer system,wherein the system comprises at least one electronic device having oneor more hardware components configured to: monitor the activityperformed on the computer system, wherein the monitored activityincludes a plurality of actions performed on the computer system and aplurality of objects accessed in the plurality of actions performed onthe computer system; determine a chronological timeline for theplurality of actions performed on the computer system; infer one or morerelationships between the plurality of objects and the plurality ofactions in the chronological timeline; classify each of the plurality ofobjects and each of the plurality of actions in one or more of theplurality of categories based on the one or more inferred relationships;and display the one or more inferred relationships on a display device.12. The system of claim 11, wherein the one or more hardware componentsassociated with the at least one electronic device are furtherconfigured to define the plurality of categories in response toreceiving an input that establishes the plurality of categories.
 13. Thesystem of claim 12, wherein to define the plurality of categories, theone or more hardware components associated with the at least oneelectronic device are further configured to nest a first one of theplurality of categories within a second one of the plurality ofcategories in response to the input that establishes the plurality ofcategories.
 14. The system of claim 11, wherein the one or more hardwarecomponents associated with the at least one electronic device arefurther configured to search the activity performed on the computersystem for one or more of the plurality of actions that are classifiedin one or more of the plurality of categories.
 15. The system of claim11, wherein the one or more hardware components associated with the atleast one electronic device are further configured to determine astrength for each of the one or more relationships, wherein the one ormore relationships are inferred in response to determining that thestrength for each of the one or more relationships exceed a thresholdvalue.
 16. The system of claim 15, wherein at least one of therelationships are not inferred in response to determining that thestrength for the at least one relationship does not exceed the thresholdvalue.
 17. The system of claim 11, wherein the plurality of actionsinclude one or more of actions that the computer system performs oractions that a user performs on the computer system.
 18. The system ofclaim 11, wherein the chronological timeline for the plurality ofactions comprises a first chronological timeline for a first computersystem, and wherein the one or more hardware components associated withthe at least one electronic device are further configured to: monitoractivity performed on a second computer system, wherein the monitoredactivity performed on the second computer system includes one or moreactions performed on the second computer system and one or more objectsaccessed in the one or more actions performed on the second computersystem; determine a second chronological timeline for the one or moreactions performed on the second computer system, wherein the one or moreactions performed on the second computer system each occur at arespective chronological position in the second chronological timeline;and display an aggregate timeline for the first computer system and thesecond computer system on the display device, wherein the aggregatetimeline includes the plurality of actions performed on the firstcomputer system and the one or more actions performed on the secondcomputer system.
 19. The system of claim 11, wherein the plurality ofactions include each occur at a respective chronological position in thechronological timeline.
 20. The system of claim 19, wherein the one ormore hardware components associated with the at least one electronicdevice derives the one or more inferred relationships from thechronological positions for the plurality of actions in thechronological timeline.